cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Rapport de ZHPDiag v2013.10.16.42 - Nicolas Coolman (16/10/2013)
~ Lanc� par Bill Gates (23/02/2014 18:59:35)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance � la d�sinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activ�e par le programme
~ El�vation des Privil�ges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.16518
MFIE: Mozilla Firefox 27.0.1
GCIE: Google Chrome v33.0.1750.117 (Defaut)
OBIE: Safari v5.34.57.2

---\\ Informations sur les produits Windows
~ Langage: Fran�ais
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK

---\\ Logiciels de protection du syst�me
Avira Free Antivirus v14.0.2.286
Malwarebytes Anti-Malware version 1.75.0.1300
Windows Defender W7

---\\ Logiciels d'optimisation du syst�me
CCleaner v3.17 =>Piriform Ltd

---\\ Logiciels de partage PeerToPeer
Pando Media Booster v2.6.0.8
�Torrent v3.1.3 =>P2P.�Torrent

---\\ Surveillance de Logiciels
Adobe Flash Player 12 Plugin
Adobe Reader X
Java 7 Update 51

---\\ Informations sur le syst�me
~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 4043 MB (48% free)
System Restore: Activ� (Enable)
System drive C: has 246 GB (43%) free of 571 GB

---\\ Mode de connexion au syst�me
~ Computer Name: BILLGATES-HP
~ User Name: Bill Gates
~ All Users Names: OA, HomeGroupUser$, Bill Gates, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Bill Gates\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Bill Gates\AppData\Roaming\
~ %Desktop% : C:\Users\Bill Gates\Desktop\
~ %Favorites% : C:\Users\Bill Gates\Favorites\
~ %LocalAppData% : C:\Users\Bill Gates\AppData\Local\
~ %StartMenu% : C:\Users\Bill Gates\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enum�ration des unit�s disques
C: Hard drive, Flash drive, Thumb drive (Free 246 Go of 571 Go)
D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 21 Go)
E: Hard drive, Flash drive, Thumb drive (Free 0 Go of 4 Go)
F: CD-ROM drive (Not Inserted)
G: CD-ROM drive (Free 0 Go of 3 Go)



---\\ Etat du Centre de S�curit� Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 38 Legitimates Filtered in 00mn 00s



---\\ Recherche particuli�re de fichiers g�n�riques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.04/11/2011 - 22:57:32.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de d�marrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.263B6E451526A90FF8B1CEC759F22956] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.06/02/2014 - 10:24:52.) -- C:\Windows\System32\wininet.dll [2334208]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d�ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioth�que de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.04/11/2011 - 22:59:54.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du syst�me de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parall�le.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.DF8126BD41180351A093A3AD2FC8903B] - (.Microsoft Corporation - Pilote de clich� instantan� du volume.) (.04/11/2011 - 22:55:34.) -- C:\Windows\system32\Drivers\volsnap.sys [296320]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cach�s (Cach�/Total)
~ Mes images (My Pictures) : 2/136
~ Mes musiques (My Musics) : 2/3
~ Mes Videos (My Videos) : 2/257
~ Mes Favoris (My Favorites) : 1/14
~ Mes Documents (My Documents) : 3/32563
~ Mon Bureau (My Desktop) : 3/45007
~ Menu demarrer (Programs) : 1/53
~ Hidden Files: Scanned in 02mn 09s



---\\ Processus lanc�s
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.1052]
[MD5.B7F55E2AE978D3D34F7876EE5D689AAE] - (.CyberLink - YouCam Mirage.) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [136488] [PID.2040]
[MD5.10E89F598469C60D8C87A8218089A87D] - (.Akamai Technologies, Inc. - Akamai NetSession Client.) -- C:\Users\Bill Gates\AppData\Local\Akamai\netsession_win.exe [4489472] [PID.3824]
[MD5.4458989C34FA84B5A75DD3ABCFBE786A] - (.Pas de propri�taire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624] [PID.2544]
[MD5.C948AC73822CA662CF44185B909EA18B] - (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe [720064] [PID.3756]
[MD5.82713AE7E1B97D56F2C43960142F5658] - (.Microsoft Corporation - Microsoft OneDrive.) -- C:\Users\Bill Gates\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257224] [PID.856]
[MD5.6C3DBE1AB6E79D29C53A2242044DCC76] - (.Hewlett-Packard Company - HP QuickWeb Utilities.) -- C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [169528] [PID.1572]
[MD5.8A3B69683E63808719D24E1C68C21CC7] - (.Hewlett-Packard Development Company, L.P. - HP On Screen Display.) -- C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960] [PID.3204]
[MD5.D658AB1B55127D18DCFBCAC8CAAEA522] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208] [PID.4104]
[MD5.DD231039B13EC2ABDE315D76E658EF0E] - (.Avira Operations GmbH & Co. KG - Antivirus System Tray Tool (Desktop).) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600] [PID.4132]
[MD5.8192B2E274607D1D530F5C191698C544] - (.Hewlett-Packard Development Company, L.P. - HP Message Service.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944] [PID.4276]
[MD5.F6158734F1E24C6C510155CF0D363911] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512] [PID.4412]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.4544]
[MD5.6E6656C6618C4B0B000267D9AF9EF743] - (.Google Inc. - Google Chrome.) -- C:\Users\Bill Gates\AppData\Local\Google\Chrome\Application\chrome.exe [859464] [PID.5844]
[MD5.281AA535DB9FA6C906656E04734CAC72] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8094720] [PID.6260]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, D�marrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Bill Gates\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [fepbnnnkkadjhjahcafoaglimekefifl] Readium v.2.12.4 (Activ�)
G2 - GCE: Preference [User Data\Default] [gfdkimpbcpahaombhbimeihdjnejgicl] Feedback v.1.0 (Activ�)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activ�)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activ�)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activ�)
~ Google Browser: 16 Legitimates Filtered in 00mn 01s



---\\ Internet Explorer, D�marrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://allssearch.com =>Adware.SocialSkinz
~ IE Browser: 12 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) [64Bits] - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} Cl� orpheline
~ Toolbar: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Cygwin64 Terminal.lnk . (.Andy Koppe - Terminal.) -- C:\cygwin64\bin\mintty.exe
O4 - GS\Desktop [Public]: FL Studio 11.lnk . (.Image-Line - FL Studio launcher.) -- C:\Users\Bill Gates\Desktop\FL Studio 11\FL.exe
O4 - GS\Desktop [Public]: Game Booster 3.lnk . (.IObit - Game Booster.) -- C:\Program Files (x86)\IObit\Game Booster 3\GameBooster.exe
O4 - GS\Desktop [Public]: Garena Plus.lnk . (...) -- C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe
O4 - GS\Desktop [Public]: HP+.lnk . (...) -- C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe
O4 - GS\Desktop [Public]: Inkscape.lnk . (.inkscape.org - Inkscape.) -- C:\Program Files (x86)\Inkscape\inkscape.exe
O4 - GS\Desktop [Public]: Kobo.lnk . (...) -- C:\Program Files (x86)\Kobo\Kobo.exe
O4 - GS\Desktop [Public]: LaCie Desktop Manager.lnk . (.LaCie - LaCie Desktop Manager.) -- C:\Program Files\LaCie\Desktop Manager\LaCieDesktopManager.exe
O4 - GS\Desktop [Public]: Magic Control.lnk . (.Easybits Software - Parental Control for Magic Desktop.) -- C:\Program Files (x86)\EasyBits For Kids\ezParentalControlMD.exe
O4 - GS\Desktop [Public]: Magic Desktop.lnk . (.EasyBits Software - Magic Desktop Launcher.) -- C:\Program Files (x86)\EasyBits For Kids\ezMDLauncher.exe
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: MPLAB IDE v8.00.lnk . (.Microchip Technology Inc. - MPLAB IDE.) -- C:\Program Files (x86)\Microchip\MPLAB IDE\Core\MPLAB.exe
O4 - GS\Desktop [Public]: OpenOffice 4.0.0.lnk . (.Apache Software Foundation - OpenOffice 4.0.0.) -- C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
O4 - GS\Desktop [Public]: PDFill PDF Editor.lnk . (.PlotSoft L.L.C. - PDFill PDF Editor 11.0.) -- C:\Program Files (x86)\PlotSoft\PDFill\PDFill.exe
O4 - GS\Desktop [Public]: PDFill PDF Tools (Free).lnk . (.PlotSoft L.L.C. - PDFill PDF Tools 11.0.) -- C:\Program Files (x86)\PlotSoft\PDFill\PDFill_PDF_Tools.exe
O4 - GS\Desktop [Public]: PDFill PDF Writer (Free).lnk . (.PlotSoft LLC - PDFill FREE PDF and Image Writer.) -- C:\Program Files (x86)\PlotSoft\PDFill\WriterSave.exe
O4 - GS\Desktop [Public]: RaRa Music.lnk . (...) -- C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe
O4 - GS\Desktop [Public]: Switch to Gaming Mode.lnk . (.IObit - Game Booster.) -- C:\Program Files (x86)\IObit\Game Booster 3\GameBooster.exe
O4 - GS\Desktop [Public]: Tomb Raider SURVIVAL EDITION.lnk . (.Square Enix - Tomb Raider.) -- C:\Users\Bill Gates\Desktop\Tomb Raider SURVIVAL EDITION\TombRaider.exe
O4 - GS\Desktop [Public]: �Torrent.lnk . (.BitTorrent, Inc. - �Torrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\Program [Public]: FL Studio 11.lnk . (.Image-Line - FL Studio launcher.) -- C:\Users\Bill Gates\Desktop\FL Studio 11\FL.exe
O4 - GS\Program [Public]: Inkscape.lnk . (.inkscape.org - Inkscape.) -- C:\Program Files (x86)\Inkscape\inkscape.exe
O4 - GS\Program [Public]: Magic Control.lnk . (.Easybits Software - Parental Control for Magic Desktop.) -- C:\Program Files (x86)\EasyBits For Kids\ezParentalControlMD.exe
O4 - GS\Program [Public]: Magic Desktop.lnk . (.EasyBits Software - Magic Desktop Launcher.) -- C:\Program Files (x86)\EasyBits For Kids\ezMDLauncher.exe
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [Public]: Safari.lnk . (...) -- C:\Windows\Installer\{C779648B-410E-4BBA-B75B-5815BCEFE71D}\SafariIco.exe
O4 - GS\QuickLaunch [OA]: CodeBlocks.lnk . (...) -- C:\Program Files (x86)\CodeBlocks\codeblocks.exe
O4 - GS\QuickLaunch [OA]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [OA]: �Torrent.lnk . (...) -- C:\Users\Bill Gates\Desktop\�Torrent\uTorrent.exe (.not file.) =>P2P.�Torrent
O4 - GS\TaskBar [OA]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Bill Gates\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar [OA]: HP Recommended.LNK . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe (.not file.)
O4 - GS\TaskBar [OA]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [OA]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [OA]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [OA]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [OA]: Algobox.lnk . (...) -- C:\Program Files (x86)\Algobox\algobox.exe
O4 - GS\Desktop [OA]: Altered Beast.lnk . (...) -- C:\Program Files (x86)\Altered Beast\Fusion.exe
O4 - GS\Desktop [OA]: Artisteer 3.lnk . (.ExtenSoft - Artisteer.) -- C:\Program Files (x86)\Artisteer 3\bin\Artisteer.exe
O4 - GS\Desktop [OA]: Assassin's Creed Brotherhood.lnk - Cl� orpheline
O4 - GS\Desktop [OA]: CodeBlocks.lnk . (...) -- C:\Program Files (x86)\CodeBlocks\codeblocks.exe
O4 - GS\Desktop [OA]: Continue Key Generator Setup.lnk . (...) -- C:\Users\Bill Gates\AppData\Local\Temp\DownloadManager.exe (.not file.)
O4 - GS\Desktop [OA]: Dreamweaver.lnk . (.Adobe Systems, Inc. - Adobe Dreamweaver CS5.) -- C:\Users\Bill Gates\Downloads\Adobe Dreamweaver CS5 Portable\Dreamweaver.exe
O4 - GS\Desktop [OA]: FL Studio 10.lnk . (...) -- C:\Users\Bill Gates\Documents\FL Studio by Vinoth Venedittan\FL.exe (.not file.)
O4 - GS\Desktop [OA]: FL Studio 11 - Raccourci.lnk . (...) -- C:\Users\Bill Gates\Desktop\FL Studio 11
O4 - GS\Desktop [OA]: FLV to AVI MPEG WMV 3GP MP4 iPod Converter.lnk . (...) -- C:\Program Files (x86)\FLV to AVI MPEG WMV 3GP MP4 iPod Converter\FLV to AVI MPEG WMV 3GP MP4 iPod Converter.exe (.not file.)
O4 - GS\Desktop [OA]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Bill Gates\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [OA]: pes2012.lnk . (.Konami Digital Entertainment Co., Ltd. - Pro Evolution Soccer 2012.) -- C:\Users\Bill Gates\Documents\PES 2012\program files\KONAMI\Pro Evolution Soccer 2012\pes2012.exe
O4 - GS\Desktop [OA]: Pes2013.lnk . (.Konami Digital Entertainment Co., Ltd. - Pro Evolution Soccer 2013.) -- C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\pes2013.exe
O4 - GS\Desktop [OA]: Pro Evolution Soccer 6 DEMO.lnk . (.KONAMI - pes6.exe.) -- C:\Program Files (x86)\KONAMI\PES6 DEMO\pes6.exe
O4 - GS\Desktop [OA]: Remember Me.lnk . (.CAPCOM U.S.A, INC http://www.capcom.com/us - Remember Me.) -- C:\Program Files (x86)\Remember Me\Binaries\Win32\RememberMe.exe
O4 - GS\QuickLaunch [Bill Gates]: Artisteer 3.lnk . (.ExtenSoft - Artisteer.) -- C:\Program Files (x86)\Artisteer 3\bin\Artisteer.exe
O4 - GS\QuickLaunch [Bill Gates]: CodeBlocks.lnk . (...) -- C:\Program Files (x86)\CodeBlocks\codeblocks.exe
O4 - GS\QuickLaunch [Bill Gates]: D-Jix Media LE.lnk . (.D-Jix - D-Jix Media LE.) -- C:\Users\Bill Gates\AppData\Roaming\D-Jix\D-Jix Media LE\D-Jix Media LE.exe
O4 - GS\QuickLaunch [Bill Gates]: Inkscape.lnk . (.inkscape.org - Inkscape.) -- C:\Program Files (x86)\Inkscape\inkscape.exe
O4 - GS\QuickLaunch [Bill Gates]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Bill Gates]: FL Studio 11.lnk . (.Image-Line - FL Studio launcher.) -- C:\Users\Bill Gates\Desktop\FL Studio 11\FL.exe
O4 - GS\TaskBar [Bill Gates]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Bill Gates\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar [Bill Gates]: HP Recommended.LNK . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe (.not file.)
O4 - GS\TaskBar [Bill Gates]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [Bill Gates]: DC Universe Online Live.lnk . (...) -- C:\Users\Public\Sony Online Entertainment\Installed Games\DC Universe Online Live\LaunchPad.exe (.not file.)
O4 - GS\Program [Bill Gates]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Bill Gates]: Norton Product Installer.lnk . (...) -- C:\Users\OA\AppData\Local\Temp\SymInstallStub.exe (.not file.)
O4 - GS\SystemTools [Bill Gates]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Bill Gates]: Algobox.lnk . (...) -- C:\Program Files (x86)\Algobox\algobox.exe
O4 - GS\Desktop [Bill Gates]: Altered Beast.lnk . (...) -- C:\Program Files (x86)\Altered Beast\Fusion.exe
O4 - GS\Desktop [Bill Gates]: Artisteer 3.lnk . (.ExtenSoft - Artisteer.) -- C:\Program Files (x86)\Artisteer 3\bin\Artisteer.exe
O4 - GS\Desktop [Bill Gates]: D-Jix Media LE.lnk . (.D-Jix - D-Jix Media LE.) -- C:\Users\Bill Gates\AppData\Roaming\D-Jix\D-Jix Media LE\D-Jix Media LE.exe
O4 - GS\Desktop [Bill Gates]: Dreamweaver.lnk . (.Adobe Systems, Inc. - Adobe Dreamweaver CS5.) -- C:\Users\Bill Gates\Downloads\Adobe Dreamweaver CS5 Portable\Dreamweaver.exe
O4 - GS\Desktop [Bill Gates]: HP Support Assistant.lnk . (.Hewlett-Packard Company - HP Support Assistant.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe =>.Hewlett-Packard Co
O4 - GS\Desktop [Bill Gates]: pes2012.lnk . (.Konami Digital Entertainment Co., Ltd. - Pro Evolution Soccer 2012.) -- C:\Users\Bill Gates\Documents\PES 2012\program files\KONAMI\Pro Evolution Soccer 2012\pes2012.exe
O4 - GS\Desktop [Bill Gates]: Pes2013.lnk . (.Konami Digital Entertainment Co., Ltd. - Pro Evolution Soccer 2013.) -- C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\pes2013.exe
O4 - GS\Desktop [Bill Gates]: Pro Evolution Soccer 6 DEMO.lnk . (.KONAMI - pes6.exe.) -- C:\Program Files (x86)\KONAMI\PES6 DEMO\pes6.exe
~ Global Startup: 156 Legitimates Filtered in 00mn 07s



---\\ Applications lanc�es au d�marrage du syt�me (O4)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.)
O4 - HKLM\..\Run: [SysTrayApp] . (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\sttray64.exe
O4 - HKLM\..\Run: [SetDefault] . (.Hewlett-Packard Development Company, L.P. - SetDefault.) -- C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe
O4 - HKLM\..\Run: [Zune Launcher] . (.Microsoft Corporation - Zune Auto-Launcher.) -- C:\Program Files\Zune\ZuneLauncher.exe
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Run: [LaCie Desktop Manager Launcher] C:\Program Files\LaCie\Desktop Manager\lacie_launcherd.exe (.not file.)
O4 - HKLM\..\RunOnce: [NCPluginUpdater] . (.Hewlett-Packard - NCPluginUpdater.) -- C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe
O4 - HKCU\..\Run: [Akamai NetSession Interface] . (.Akamai Technologies, Inc. - Akamai NetSession Client.) -- C:\Users\Bill Gates\AppData\Local\Akamai\netsession_win.exe
O4 - HKCU\..\Run: [Pando Media Booster] . (.Pas de propri�taire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKCU\..\Run: [GrooveMonitor] . (.Microsoft Corporation - Microsoft SharePoint Workspace Monitor.) -- C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.exe
O4 - HKCU\..\Run: [SkyDrive] . (.Microsoft Corporation - Microsoft OneDrive.) -- C:\Users\Bill Gates\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\Bill Gates\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc
O4 - HKCU\..\Run: [LaCie Desktop Manager Startup] . (...) -- C:\Program Files\LaCie\Desktop Manager\LaCieDesktopManagerStatusItem.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKCU\..\Run: [uTorrent] . (.BitTorrent, Inc. - �Torrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst� Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [HPQuickWebProxy] . (.Hewlett-Packard Company - HP QuickWeb Utilities.) -- C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [HPOSD] . (.Hewlett-Packard Development Company, L.P. - HP On Screen Display.) -- C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
O4 - HKLM\..\Wow6432Node\Run: [Easybits Recovery] . (.EasyBits Software AS - Power off recovery for Magic Desktop.) -- C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe =>.EasyBits Software AS
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Wow6432Node\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Antivirus System Tray Tool (Desktop).) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Wow6432Node\Run: [AdobeCS6ServiceManager] . (.Adobe Systems Incorporated - Adobe CS6 Service Manager.) -- C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe
O4 - HKLM\..\Wow6432Node\Run: [HP Quick Launch] . (.Hewlett-Packard Development Company, L.P. - HP Message Service.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
O4 - HKLM\..\Wow6432Node\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe =>.RealNetworks, Inc
O4 - HKLM\..\Wow6432Node\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [Akamai NetSession Interface] . (.Akamai Technologies, Inc. - Akamai NetSession Client.) -- C:\Users\Bill Gates\AppData\Local\Akamai\netsession_win.exe
O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [Pando Media Booster] . (.Pas de propri�taire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [GrooveMonitor] . (.Microsoft Corporation - Microsoft SharePoint Workspace Monitor.) -- C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.exe
O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [SkyDrive] . (.Microsoft Corporation - Microsoft OneDrive.) -- C:\Users\Bill Gates\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\Bill Gates\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc
O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [LaCie Desktop Manager Startup] . (...) -- C:\Program Files\LaCie\Desktop Manager\LaCieDesktopManagerStatusItem.exe
O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [uTorrent] . (.BitTorrent, Inc. - �Torrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Application: Scanned in 00mn 00s



---\\ Boutons situ�s sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 [64Bits] - {25510184-5A38-4A99-B273-DCA8EEF6CD08} . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\Resources\Icons\HP.ico
O9 - Extra button: Se&nd to OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} -- C:\Program Files (x86)\MICROS~2\Office14\ONBttnIE.dll (.not file.)
O9 - Extra button: OneNote Lin&ked Notes [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} -- C:\Program Files (x86)\MICROS~2\Office14\ONBTTN~1.dll (.not file.)
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] *.clonewarsadventures.com
O15 - Trusted Zone: [HKCU\...\Domains] *.freerealms.com
O15 - Trusted Zone: [HKCU\...\Domains] *.soe.com
O15 - Trusted Zone: [HKCU\...\Domains] *.sony.com
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{86A1060B-F46C-48C2-A652-BD31EE898622}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0B10EA4-A50D-4549-843C-47D61398A473}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{86A1060B-F46C-48C2-A652-BD31EE898622}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{A0B10EA4-A50D-4549-843C-47D61398A473}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{86A1060B-F46C-48C2-A652-BD31EE898622}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS2\Services\Tcpip\..\{A0B10EA4-A50D-4549-843C-47D61398A473}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-cl�s Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Cl� de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} . (.EldoS Corporation - CbFs Mount Notifier.) -- C:\Windows\system32\CbFsMntNtf3.dll
~ SSODL: 2 Legitimates Filtered in 00mn 00s



---\\ Cl� de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) [64Bits] - {5FF49FE8-B332-4CB9-B102-FB6951629E55} . (.EldoS Corporation - CbFs Mount Notifier.) -- C:\Windows\SysWOW64\CbFsMntNtf3.dll
~ STS/SSO: Scanned in 00mn 00s



---\\ T�ches planifi�es en automatique (O39)
[MD5.3AADCF0B983E96111F1610613973411C] [APT] [AutoKMS] (...) -- C:\Windows\AutoKMS\AutoKMS.exe [3152384] =>Trojan.Keygen
[MD5.00000000000000000000000000000000] [APT] [{36DBC82D-8FF0-4D83-86AD-92E6CB4B0D86}] (...) -- C:\Users\Bill Gates\DownlBill Gatesds\UDKInstall-2012-05-BETA.exe (.not file.) [0]
[MD5.65A8E159C87834C135275332CD99600F] [APT] [{70D853EF-88F2-4F60-AFED-754C23686337}] (...) -- G:\Autorun.exe [120128]
[MD5.C25D1BCC8AE3FE057E731E11192AF2F7] [APT] [{7800B4EF-54E5-4AC0-A07F-A94659B62507}] (...) -- C:\Users\Bill Gates\Desktop\CodeBlocks-EP\codeblocks.exe [294414]
[MD5.00000000000000000000000000000000] [APT] [{B8A840EC-EEC0-4356-892C-DEA8D7988F1E}] (...) -- C:\Users\Bill Gates\Downloads\pro_evolution_soccer_6_demo.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D2E77054-4C40-4A65-8C7C-3AD76F36D58B}] (...) -- C:\Users\Bill Gates\Downloads\ZHPDiag2 (1).exe (.not file.) [0]
~ Scheduled Task: 55 Legitimates Filtered in 00mn 09s



---\\ Logiciels install�s (O42)
O42 - Logiciel: Akamai NetSession Interface Service - (...) [HKLM][64Bits] -- Akamai
O42 - Logiciel: HI-TECH PICC-Lite V9.60PL1 - (.HI-TECH Software.) [HKLM][64Bits] -- PICC 9.60PL1
~ Logic: 242 Legitimates Filtered in 00mn 02s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\IncrediMail]
[HKCU\Software\InstalledBrowserExtensions] =>Adware.VidSaver
[HKCU\Software\OGPlanet]
[HKCU\Software\OldSchoolInject]
[HKCU\Software\Pando Networks]
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\IncrediMail]
[HKLM\Software\Wow6432Node\PCTools]
[HKLM\Software\Wow6432Node\Pando Networks]
~ Key Software: 372 Legitimates Filtered in 00mn 02s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 01/07/2013 - 14:31:29 - [3,950] ----D C:\Program Files (x86)\Altered Beast
O43 - CFD: 15/02/2014 - 17:31:00 - [0] ----D C:\Program Files (x86)\OGPlanet
O43 - CFD: 29/03/2012 - 17:41:50 - [7,234] ----D C:\Program Files (x86)\Pando Networks
O43 - CFD: 18/01/2014 - 11:18:38 - [43,420] ----D C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}
O43 - CFD: 03/05/2013 - 23:40:58 - [0] --H-D C:\ProgramData\{E26B3878-7CEC-469C-B449-5CAA336DF8CD}
O43 - CFD: 19/02/2014 - 23:23:49 - [0] ----D C:\Users\Bill Gates\AppData\Local\Setup Integrity Check
O43 - CFD: 23/07/2013 - 23:59:10 - [0,002] ----D C:\Users\Bill Gates\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OGPlanet
~ Program Folder: 294 Legitimates Filtered in 01mn 44s



---\\ Derniers fichiers modifi�s ou cr�es sous Windows et System32 (O44)
O44 - LFC:[MD5.04C3DB3B4AD9EE8FD5F07B6719A57977] - 09/02/2014 - 11:57:48 ---A- . (...) -- C:\MPUsbSIn.log [317]
O44 - LFC:[MD5.E13F489F0B1E52319A86BDD996263F4B] - 15/02/2014 - 10:52:03 ---A- . (...) -- C:\Windows\win.ini [478]
O44 - LFC:[MD5.F4EE302AFBCE0B94CD33C6B3941D19E2] - 21/02/2014 - 23:55:18 ---A- . (...) -- C:\Windows\SysNative\devicealertlist.txt [16]
O44 - LFC:[MD5.F4EE302AFBCE0B94CD33C6B3941D19E2] - 21/02/2014 - 23:55:18 ---A- . (...) -- C:\Windows\SysNative\devicelist.txt [16]
O44 - LFC:[MD5.F4EE302AFBCE0B94CD33C6B3941D19E2] - 21/02/2014 - 23:55:18 ---A- . (...) -- C:\Windows\System32\devicealertlist.txt [16]
O44 - LFC:[MD5.F4EE302AFBCE0B94CD33C6B3941D19E2] - 21/02/2014 - 23:55:18 ---A- . (...) -- C:\Windows\System32\devicelist.txt [16]
O44 - LFC:[MD5.F6F5FF151993B20AAE73D7BC8B8976B5] - 23/02/2014 - 18:45:12 ---A- . (...) -- C:\Windows\SysNative\deviceAppeared.txt [15]
O44 - LFC:[MD5.F6F5FF151993B20AAE73D7BC8B8976B5] - 23/02/2014 - 18:45:12 ---A- . (...) -- C:\Windows\System32\deviceAppeared.txt [15]
O44 - LFC:[MD5.862682EC2C1162053EC621135841F778] - 23/02/2014 - 18:45:12 ---A- . (...) -- C:\log2.txt [0]
O44 - LFC:[MD5.874C84EE796A2F72B0CF76FC4DFFAC6E] - 23/02/2014 - 19:04:43 --HA- . (...) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [32064]
O44 - LFC:[MD5.874C84EE796A2F72B0CF76FC4DFFAC6E] - 23/02/2014 - 19:04:43 --HA- . (...) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [32064]
~ Files: 104 Legitimates Filtered in 01mn 15s



---\\ Op�rations et fonctions au d�marrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - EasyBits Security Shield Hook - prevents launching insecure programs by kids [64Bits] - {E54729E8-643D-4270-9D49-7389EA579090} - Cl� orpheline
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Cl� de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{13bdc4cb-4f47-11e2-96fc-80c16e3cedf5}\AutoRun\command. (...) -- G:\setup.exe (.not file.)
O51 - MPSK:{b67d7a9b-998e-11e3-8dfd-80c16e3cedf5}\AutoRun\command. (...) -- G:\Autorun.exe
~ Keys: Scanned in 00mn 00s



---\\ Enum�ration des cl�s de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLinkedConnections"=1
~ MWPS: 22 Legitimates Filtered in 00mn 00s



---\\ Enum�ration des cl�s de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoLogoff"=0
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoClose"=0
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 7 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du syst�me (SDL) (O58)
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
~ Drivers: 22 Legitimates Filtered in 00mn 00s



---\\ Liste des outils de d�sinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 23/02/2014 - C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys (esgiguard) .(...) - LEGACY_ESGIGUARD =>Crapware.SpyHunter
O64 - Services: CurCS - 01/11/2010 - C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys (WinRing0_1_2_0) .(.OpenLibSys.org - WinRing0.) - LEGACY_WINRING0_1_2_0
O64 - Services: CurCS - 23/02/2014 - C:\Users\BILLGA~1\AppData\Local\Temp\005B19E.tmp (X6va005) .(...) - LEGACY_X6VA005
~ Legacy: 95 Legitimates Filtered in 00mn 27s



---\\ Menu de d�marrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Bill Gates\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\OA\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Apple Inc. - Safari.) -- C:\Program Files (x86)\Safari\Safari.exe
~ Keys: Scanned in 00mn 00s



---\\ Recherche particuli�re � la racine du syst�me (SPRF) (O84)
[MD5.D43AFB7F91E2444170A22F48E211971C] [SPRF][10/02/2014] (...) -- C:\Users\Bill Gates\Desktop\kobosetup.exe [136859176]
[MD5.2A0778490DFEFFD905CDBDCF7A065BC6] [SPRF][23/10/2009] (.reFX - reFX Nexus 2 VST plug-in.) -- C:\Users\Bill Gates\Desktop\Nexus.dll [5811712]
[MD5.68EDAC85258151885190465FC1DAF7BD] [SPRF][25/01/2014] (...) -- C:\Users\Bill Gates\Desktop\RogueKiller.exe [3792384]
~ Files: 8 Legitimates Filtered in 00mn 02s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "TCP Query User{DA550944-9B5D-4A4B-9738-975C118B3C82}C:\program files (x86)\ogplanet\zone4\zone4_na.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files (x86)\ogplanet\zone4\zone4_na.exe (.not file.)
O87 - FAEL: "UDP Query User{958D7F9A-6211-4E3C-A39E-99235F20A8DD}C:\program files (x86)\ogplanet\zone4\zone4_na.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files (x86)\ogplanet\zone4\zone4_na.exe (.not file.)
O87 - FAEL: "TCP Query User{0BA650F3-15AB-48A0-9E46-92CFDF38BEC7}C:\users\bill gates\documents\client moustikk\dkmt2 lenceur.exe" | In - Private - P6 - TRUE | .(...) -- C:\users\bill gates\documents\client moustikk\dkmt2 lenceur.exe
O87 - FAEL: "UDP Query User{26D128FB-0E23-4F1B-AD1D-15B22CC74574}C:\users\bill gates\documents\client moustikk\dkmt2 lenceur.exe" | In - Private - P17 - TRUE | .(...) -- C:\users\bill gates\documents\client moustikk\dkmt2 lenceur.exe
O87 - FAEL: "TCP Query User{197DD8D4-45B8-4F12-9E4E-8F2A2170AD17}C:\users\bill gates\documents\darknessmt2 renaissance\darknessmt2.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\bill gates\documents\darknessmt2 renaissance\darknessmt2.exe (.not file.)
O87 - FAEL: "UDP Query User{0DBD452A-191E-45DB-903E-2E881A210A45}C:\users\bill gates\documents\darknessmt2 renaissance\darknessmt2.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\bill gates\documents\darknessmt2 renaissance\darknessmt2.exe (.not file.)
O87 - FAEL: "{C2B8EC36-ECCC-4FD0-9829-F08B0C369851}" |In - Private - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{60770037-E356-46E9-AF55-B00539306FA7}" |In - Private - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{474061A6-0CF5-48F5-9303-809C974AFBF2}" |In - Public - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{3AAE5BCA-78ED-4B6F-BB90-039ECC38803C}" |In - Public - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "TCP Query User{EEFA3BEA-E634-4C09-B134-CCE4A37313B5}C:\users\bill gates\downloads\ultra\ultima-online.exe" | In - Private - P6 - TRUE | .(...) -- C:\users\bill gates\downloads\ultra\ultima-online.exe
O87 - FAEL: "UDP Query User{F750A17D-2EE6-4140-9578-1D2EDA7B5F4C}C:\users\bill gates\downloads\ultra\ultima-online.exe" | In - Private - P17 - TRUE | .(...) -- C:\users\bill gates\downloads\ultra\ultima-online.exe
O87 - FAEL: "TCP Query User{DA89ACED-2C16-4203-9F3B-379C620C397E}H:\microsoft toolkit.exe" |In - Private - P6 - TRUE | .(...) -- H:\microsoft toolkit.exe (.not file.)
O87 - FAEL: "UDP Query User{47E72881-D8E6-46BC-A83F-C7B9D7839DB9}H:\microsoft toolkit.exe" |In - Private - P17 - TRUE | .(...) -- H:\microsoft toolkit.exe (.not file.)
~ Firewall: 289 Legitimates Filtered in 00mn 04s



---\\ Enum�re les codes produits des logiciels (PUC) (O90)
O90 - PUC: "477563222A8A610499ADC484D61A73DE" . (.MPLAB Tools v8.00.) -- C:\Windows\Installer\{22365774-A8A2-4016-99DA-4C486DA137ED}\ARPPRODUCTICON.exe
O90 - PUC: "95731AF9B2C57714D9CD00838F5BEBDF" . (.Bing Bar.) -- C:\Windows\Installer\{9FA13759-5C2B-4177-9DDC-0038F8B5BEFD}\icon_installer_ico =>Toolbar.Bing
~ Update Products: 212 Legitimates Filtered in 00mn 00s



---\\ Etat g�n�ral des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 18/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 20/02/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 14/07/2009 27136 | c:\program files (x86)\common files\akamai\netsession_win_8fa3539.dll (Akamai) . (.Akamai Technologies, Inc..) - C:\Windows\System32\svchost.exe
SR - | Auto 18/08/2011 204288 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 19/12/2013 440376 | (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
SR - | Auto 13/12/2013 440376 | (AntiVirService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
SS - | Demand 01/08/2011 195320 | (BBSvc) . (.Microsoft Corporation..) - C:\Program Files (x86)\Microsoft\BingBar\BBSvc.exe
SR - | Auto 20/07/2011 249648 | (BBUpdate) . (.Microsoft Corporation.) - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.exe
SR - | Auto 10/07/1658 0 | (ezSharedSvc) . (.EasyBits Software AS.) - C:\Windows\System32\ezSharedSvcHost.exe =>.EasyBits Software AS
SS - | Demand 09/11/2013 227936 | (GamesAppIntegrationService) . (.WildTangent.) - C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
SS - | Demand 12/10/2010 206072 | (GamesAppService) . (.WildTangent, Inc..) - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
SR - | Auto 16/09/2012 662104 | (GenieTimelineService) . (.Genie9.) - C:\Program Files\Genie9\Genie Timeline\GenieTimelineService.exe
SS - | Auto 05/07/2012 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 05/07/2012 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SR - | Auto 04/11/2013 92160 | (HP Support Assistant Service) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe =>.Hewlett-Packard Co
SR - | Auto 16/02/2011 682040 | (HPAuto) . (.Hewlett-Packard.) - C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe
SR - | Auto 11/10/2010 346168 | (HPClientSvc) . (.Hewlett-Packard Company.) - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
SR - | Auto 13/05/2013 270624 | (HPDrvMntSvc.exe) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
SR - | Demand 13/05/2013 1129760 | (hpqwmiex) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
SR - | Auto 05/03/2012 35200 | (HPWMISVC) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
SR - | Auto 30/04/2011 13592 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SS - | Auto 01/09/2011 2425960 | (IconMan_R) . (.Realsil Microelectronics Inc..) - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
SS - | Demand 14/11/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
SR - | Auto 06/06/2012 149872 | (InstallClick) . (...) - C:\Program Files (x86)\RIFT Technologies\InstallClick Connector\installclick.exe
SR - | Auto 27/03/2013 1379840 | (LaCieDesktopManagerService) . (...) - C:\Program Files\LaCie\Desktop Manager\lacie_dm_service.exe
SR - | Auto 01/02/2011 326168 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Demand 22/02/2014 118896 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SR - | Auto 10/07/1658 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SR - | Auto 14/08/2013 39056 | (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
SS - | Auto 01/03/2013 161384 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SR - | Auto 08/09/2011 305152 | (STacSV) . (.IDT, Inc..) - C:\Program Files\IDT\WDM\STacSV64.exe
SR - | Auto 01/02/2011 2656280 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (X6va005) . (...) - C:\Users\BILLGA~1\AppData\Local\Temp\005B19E.tmp
~ Services: Scanned in 00mn 34s



---\\ Scan Additionnel (O88)
Database Version : 12948 - (16/10/2013)
Cl�s trouv�es (Keys found) : 9
Valeurs trouv�es (Values found) : 0
Dossiers trouv�s (Folders found) : 0
Fichiers trouv�s (Files found) : 1

[HKLM\Software\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}] =>Toolbar.Ask
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing
[HKCU\Software\InstalledBrowserExtensions\] =>PUP.CrossRider
[HKCU\Software\InstalledBrowserExtensions] =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110511071178}] =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220522072278}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110511071178}] =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220522072278}] =>PUP.CrossRider
C:\Windows\AutoKMS\AutoKMS.exe =>Trojan.Keygen^
~ Additionnel Scan: 390674 Items scanned in 00mn 29s



---\\ R�capitulatif des d�tections trouv�es sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/27480243-adware-socialskinz =>Adware.SocialSkinz
~ http://nicolascoolman.webs.com/apps/blog/show/27557062-adware-vidsaver =>Adware.VidSaver
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/26609241-crapware-spyhunter =>Crapware.SpyHunter
~ http://nicolascoolman.webs.com/apps/blog/show/31536787-toolbar-bing =>Toolbar.Bing
~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
~ MSI: 7 link(s) detected in 00mn 29s



~ 1731 Legitimates filtered by white list
End of the scan (599 lines in 07mn 43s)(0)

Publicité


Signaler le contenu de ce document

Publicité